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1 Introduction 

There is a distinctive stance in the philosophy of mathematics which is usually 
called "generalised predicativity" . It is characterised by the fact that it does 
not accept non-constructive and impredicative arguments, but it does allow for 
the existence of a wide variety of inductively defined sets. Martin-Lof's type 
theory [12] expresses this stance in its purest form. For the development of 
mathematics, however, this system has certain drawbacks: the type-theoretic 
formalism is involved and requires considerable time to get accustomed to, and 
the lack of extensionality leads to difficult conceptual problems. Aczel's inter- 
pretation of his constructive set theory CZF in Martin-Lof's type theory [1 
overcomes both problems: the language of set theory is known to any mathe- 
matician and CZF incorporates the axiom of extensionality. For this reason, 
CZF has become the standard reference for a set-theoretic system expressing 
the "generalised-predicative stance" . 

It turns out, however, that CZF is not quite strong enough to formalise all 
the mathematics which one would like to be able to formalise in it: there are 
results, in particular in formal topology, which can be proved in type theory and 
are perfectly acceptable from a generalised-predicative perspective, but which go 
beyond CZF. There seem to be essentially two reasons for this: first of all, type 
theory incorporates the "type-theoretic axiom of choice" and secondly, Martin- 
Lof type theory usually includes W-types which allow one to prove the existence 
of more inductively defined sets than can be justified in CZF alone. To address 
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this, we will suggest in this paper an extension of CZF which includes a form 
of choice and W- types, so that in it one can develop formal topology, while at 
the same time having good model-theoretic properties. 

Let us take the second point first. Already in 1986, Peter Aczel suggested 
what he called the Regular Extension Axiom (RE A) to address this issue [3]- 
The main application of (REA) is that it allows one to prove the "Set Com- 
pactness Theorem", which is important in formal topology (see [H [11]), but not 
provable in CZF proper. Here we suggest to take the axiom (WS) instead: for 
every function f:B—>A the associated W-type W(f) is a set. (This is not the 
place to review the basics of W- types, something which we have already done 
on several occasions: see, for example, |10j.) One advantage of this axiom (over 
(REA)) is that it directly mirrors the type theory. In addition, (WS) is easy 
to formulate in the categorical framework of algebraic set theory, so that one 
may use this extensive machinery to establish its basic preservation properties 
(such as stability under exact completion, realizability and sheaves), whereas for 
(REA) such a formulation does not seem to be possible. It has been claimed, 
quite plausibly, that (REA) has similar stability properties, but we have never 
seen a proof of this claim. 

As for the lack of choice in CZF, the axiom which would most directly 
mirror the type theory would be the "presentation axiom", which says that 
the category of sets has enough projectives. The problem with this axiom, 
however, is that is not stable under taking sheaves. Precisely for this reason, 
Erik Palmgren together with the second author introduced in [14] an axiom 
called the Axiom of Multiple Choice (AMC), which is implied by the existence 
of enough projectives and is stable under sheaves. This axiom (which we will 
discuss towards the end of this paper) is a bit involved and it turns out that on 
almost all occasions where one would like to use this axiom a slightly weaker 
and simpler principle suffices. This weaker principle is: 

For any set X there is a set {pf Yi -» X : i G 1} of surjections onto 
X such that for any surjection p: Y -» X onto X there is an i e I 
and a function f:Yi — > Y such that p o / = p i . 

It is this axiom which we will call (AMC) in this paper, whereas we will refer 
to the original formulation in [T3] as "strong (AMC)". (Independently from 
us, Thomas Streicher hit upon the same principle in [16] . where it was called 
TTCA/; on the nLab, http://ncatlab.org, the principle is called WISC.) 

So this is our proposal: extend the theory CZF with the combination of 
(WS) and (AMC). The resulting theory has the following properties: 

1. It is validated by Aczel's interpretation in Martin-Lof's type theory (with 
one universe closed under W-types) and therefore acceptable from a gene- 
ralised-predicative perspective. 

2. The theory is strong enough to prove the Set Compactness Theorem and 
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to develop that part of formal topology which relies on this result. 

3. The theory is stable under the key constructions from algebraic set theory, 
such as exact completion, realizability and sheaves. 

It is the purpose of this paper to prove these facts. As a result, CZF + (WS) 
+ (AMC) will be the first (and so far only) theory for which the combination 
of these properties has been proved. 

Moreover, we will show that the theory has a certain robustness about it. 
Indeed, assuming that the ground model for CZF satisfies (AMC) and (WS), 
it is impossible to use the standard model-theoretic techniques to prove inde- 
pendence of (AMC) and (WS) from CZF. To express this more formally, let 
us say that an axiom (p in the language of CZF is reflected by sheaf extensions 
(for example), if for any CZF- model £, the axiom ip holds in £ as soon as it 
holds in some sheaf extension £' of £ . Then as a fourth property of our theory 
CZF + (WS) + (AMC) we have 

4. The theory is reflected by the model constructions of exact completion, 
realizability and sheaves. 

It should be noted that establishing the first property for CZF + (WS) + 
(AMC) is quite easy, because stronger axioms are verified by the type-theoretic 
interpretation: (RE A) can be interpreted (that was the main result of [3]) 
and (REA) implies (WS) (see [6j page 5-4]), while (AMC) is an obvious 
consequence of the presentation axiom which is validated by the type-theoretic 
interpretation (see [2]). Therefore it remains to establish the other properties 
in the list. 

The contents of this paper are therefore as follows. First, we will show in 
Section 2 that the Set Compactness Theorem follows from the combination of 
(WS) and (AMC). Then we will proceed to show that these axioms are stable 
under and reflected by exact completion (Section 3), realizability (Section 4) 
and sheaves (Section 5). Throughout these sections we assume familiarity with 
the framework for algebraic set theory developed in [HI El El HHJ- Finally, in 
Section 6 we will discuss the relation of our present version of (AMC) with 
the earlier and stronger formulation from Q31 [15] and with Aczel's Regular 
Extension Axiom. 



2 The Set Compactness Theorem 

The purpose of this section is to prove that, in CZF, the combination of (WS) 
and (AMC) implies the Set Compactness Theorem. To state this Set Compact- 
ness Theorem, we need to review the basics of the theory of inductive definitions 
in CZF, which will be our metatheory in this section. 
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Definition 2.1 ff X is a class, we will denote by Pow(X) the class of subsets 
of X and if X is a set, we will denote by Surj(A) the class of surjections onto 
X. 

Definition 2.2 Let S be a set. An inductive definition on S is a subset <& of 
Pow(S') x S. If $ is an inductive definition, then a subclass A of S is ^-closed, 
if 

whenever (X, a) is in $. 

Within CZF one can prove that for every subclass U of S there is a least 
<I>-closed subclass of S containing U (see [5]); it is denoted by /($, U). The Set 
Compactness Theorem is the combination of the following two statements: 

1. /($, U) is a set whenever U is. 

2. There is a set i? of subsets of S such that for each class U C 5 and each 
a e /($, {/) there is a set V £ B such that V QU and a G /($, V). 

As said, the Set Compactness Theorem is not provable in CZF proper, but we 
will show in this section that it becomes provable when we extend CZF with 
(WS) and (AMC). 

To prove the result it will be convenient to introduce the notion of a collection 
square. In the definition we write for any function f:B—>A and each a G A, 

B a = f- 1 (a) = {beB: f(b)=a}, 

as is customary in categorical logic. 

Definition 2.3 A commuting square in the category of sets 

D—^B 

9 f 



will be called a collection square, if 

1. the map p is a surjection, 

2. the inscribed map D — > B C is a surjection (meaning that for each 
pair of elements b G B, c G C with f(b) = p{c) there is at least one d G D 
with q{d) — b and g(d) = c), 
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3. and for each a £ A and each surjection e: E -» B a there is a c £ p 1 (a) 
and a map h: D c — ► E such that the triangle 

E 



D c 



q\D c 



commutes. 



Observe that (AMC) can be rephrased as: any map /: X — > 1 fits into a 
collection square 

9 




In fact, (AMC) implies that this property holds for any map. 

Proposition 2.4 (AMC) implies that any function f:B >A fits into a col 

lection square 
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Note that for the strong version of (AMC), this is really Proposition 4.6 in 

Proof. Let /: B -» A be any function. (AMC) implies that: 

(Va G A) {3a € Pow(Surj(B a ))) every surjection onto B a is refined by one in a. 

We may now apply the collection axiom to this statement: this gives us a 
surjection p:C^>A together with, for every c G C, an inhabited collection 
Z c C Pow(Surj(B a )) such that: 

(Vc G C) (Va G Z e ) every cover of B p i c \ is refined by an element of a. 

Let T C = \JZ C . Then clearly: 

(Vc G C) every surjection onto 5 p ( c ) is refined by an element of T c . 

So set D = {(c G C, t G T c , a; G dom(t))} and let g be the projection on the first 
coordinate and g(c, £, x) = t(x). All the required verifications are now very easy 
and left to the reader. □ 
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Theorem 2.5 The combination of (WS) and (AMC) implies the Set Com- 
pactness Theorem. 



Proof. Let S be a set and $ be an inductive definition on S. Our aim is 
to construct a set B of subsets of S such that for each class U C S and each 
a G E7) there is a set G B such that F C U and a G /($, V). 

Write * = {(X, a, 6) : (X, a) G 6 G X} and consider the map h: * ->• $ given 
by projection onto the first two coordinates. By composing this map with the 
sum inclusion <J> — > $ + S, we obtain a map we call /. 

(AMC) implies that / fits into a collection square with a small map g on the 
left, as in: 

D q -^^^^X 

f (1) 

c ► $ + s. 

p 

We take the W-type W(g) associated to g and, because (WS) holds, W(g) is a 
set. We wish to regard certain elements of W(g) as proofs. 

To identify these, define a map cone: W(g) — > S assigning to every element of 
W(g) its conclusion by case distinction, as follows: 



conc(sup c (£)) 



p(c) if p(c) G S, 

a if p(c) = (X,a) G 



In addition, define inductively the function ass: W(g) — > Pow(5) assigning to 
every element of W(g) its set of assumptions as follows: 



ass(sup c (£)) 



{p(c)} ifp(c)G5, 
Ude 9 -i( c ) ass(td) otherwise. 



Finally, call an element sup c (t) G W(p) well-formed, if p(c) = (X, a) € <& implies 
that for all d G Z3 C the conclusion of t(d) is ir^qid) (the map 7r3g is the composite 
along the top in diagram (JTJ); call it a proo/, if it and all its subtrees are well- 
formed. Because the collection of subtrees of some tree in a W-type is a set (see 
the proof of Theorem 6.13 in [7]), the collection of proofs is a set by bounded 
separation. 

The proof will be finished once we show that: 

/($, U) = {x G S : there is a proof all whose assumptions belong to U 
and whose conclusion is x}. 

Because from this expression it follows by bounded separation that /($, U) is a 
set whenever U is; in addition, it implies that the set B = {ass(u>) : w G W(g)} 
is as required by the second half of the Set Compactness Theorem. 
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In other words, we have to show that 

J(<I>, U) — (3w £ W(g)) w is a proof, ass(w) C U and conc(u>) = x}. 

is $-closcd, contains U and is contained in every $-closed subclass of S which 
contains U . To see that J(Q, U) contains U, note that an element sup c (£) with 
p(c) = s € S is a proof whose sole assumption is s and whose conclusion is s. 
To see that it is ^-closed, let (X, a) £ $ and suppose that 

(V6 e X)b e J($,U); 

in other words, that 

(V6 £ X) (3w £ W(g)) w is a proof, ass(w) C [7 and conc(w) = x. 

Now we use the collection square property to obtain a c £ C with p{c) — 
(X,a) £ $ and a map t: D c —> W(g) such that for all d £ D c , td is a proof 
with ass(td) C [7 and conc(t(i) = gd. Hence sup c (i) is a proof with assumptions 
contained in U and conclusion a and therefore a £ J($, C/), as desired. 

It remains to show that </(<!>, U) contains every ^-closed subclass A containing 
U. To this purpose, we prove the following statement by induction: 

For all w £ W(g), if w is a proof and ass(u>) C U, then conc(w) £ A. 

So let w = sup c (i) £ W(g) be a proof such that ass(w) C U, For every d £ D c , 
td is a proof with &ss(td) C [7, so we have conc(id) S A by induction hypothesis. 
Now we make a case distinction as to whether p(c) belongs to S or $: 

• If p(c) £ S, then w is a proof whose sole assumption is pc and whose 
conclusion is pc. Then it follows from ass(u;) C U that pc £ U £ A. 
Hence conc(w) = pc £ A, as desired. 

• In case p(c) = (X, a) £ $, we have to show a = conc(ui) £ A and for 
that it suffices to show that b £ A for all b £ X, since A is ^-closed. But 
for every b £ X, there is a d £ D c with p(d) = (X,a,b) and, since w is 
well-formed, b = conc(id) £ A. 

This completes the proof. □ 



3 Stability under exact completion 

In the following sections we will show that (AMC) and (WS) are stable under 
exact completion, realizability, presheaves and sheaves, respectively. We will do 
this in the setting of algebraic set theory as developed in our papers [7j [9j HO] 
and to that purpose, we reformulate (AMC) in categorical terms. 
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Definition 3.1 We call a square 




a covering square, if both p and the canonical map D — > B x^C are covers. We 
will call it a collection square, if, in addition, the following statement holds in 
the internal logic: for all a € A and covers e: E -» B a there is a c £ p^ 1 (a) and 
a map h:D c ^E such that the triangle 

E 





Pc=p\D c 



^B a 



commutes. Diagrammatically, one can express the second condition by asking 
that any map X — > A and any cover E -» X B fit into a cube 



Y x n D 



D 



I 

Y 



C 



->E wX x A B 

/ 



X, 



such that the face on the left is a pullback and the face at the back is covering. 



Remark 3.2 Note that being a covering or a collection square is really a prop- 
erty of an oriented square and in the definition the maps p and / play different 
roles. In this paper we will always draw collection and covering squares in such 
a way that the property holds from "left to right" (as in the definition), instead 
of from "top to bottom" . 



In categorical terms the axiom now reads: 



Axiom of Multiple Choice (AMC): For any small map f:Y >X, there 

is a cover q: A >X such that q*f fits into a collection square in which 

all maps are small: 



D 



C- 



-»Ax x Y- 

q'f 

WA 
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We now proceed to show this axiom is stable under exact completion. We 
work in the setting of [7] and use the same notation and terminology. In partic- 
ular, (£ , S) will be a category with display maps and (£, S) will be its bounded 
exact completion as discussed in [7]. If we say that (AMC) holds in (£,S), 
then we will mean that (AMC) holds with the phrase "small map" replaced 
by "display map" . 

We begin by stating two lemmas about collection squares: 
Lemma 3.3 The embedding y:£ — y £ preserves and reflects collection squares. 
Proof. Recall from Theorem 5.2 in [7] that y has the following properties: 

1. y is full and faithful, 

2. y is covering, i.e., every object in £ is covered by one in the image of y, 

3. y preserves and reflects pullbacks, 

4. y preserves and reflects covers. 

From items 3 and 4 it follows that y preserves and reflects covering squares. 

To show that y preserves collection squares, suppose that we have a collection 
square 




in £ , a map X — >• yA and a cover E -» yB x y a X. Using item 2, we find a 
cover q: yX' — > X and a cover yE' — > (id y s x y a q)*E. Then we may apply the 
collection square property in £ to obtain a diagram of the desired shape. 

To see that y reflects collection squares, suppose that 

yD^-^yB 

yg 

yc 



yp 



■>yA 



is a collection square in £. Then, if X — > A is any map and E — > B X is 
a cover in £, this is preserved by y, so that we obtain a map t: Y — > yC and a 
covering square 

q*yD > E w yB x yA yX 

t'yg 



Y 



^yx. 
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By covering Y with an object yY', sticking the pullback square 

y(Dx c Y>) >q*yD 



yY' 



to the left of the previous diagram and reflecting back along y, we obtain a 
diagram of the desired form in £ . □ 



Lemma 3.4 Suppose we have a commuting diagram of the following shape 



E- 



» B 




where both squares are covering. If one of the two inner squares is a collection 
square, then so is the outer square. 



Proof. Covering squares compose (Lemma 2.4.2 in [7]), so the outer square is 
covering. From now on, we reason in the internal logic. Assume that left square 
is a collection square. Suppose a £ A and q:T — » B a . Since p is a cover, we find 
a c G C such that p(c) = a, and because the square on the left is collection, we 
find an element e G E together with a map p: F e — ?> a*T such that the following 
diagram commutes: 

a*T >T 




F 



/3e 



+ B a . 



Since {a(i) e — a c j3 e , this yields the desired result. The case where the right 
square is a collection square is very similar, but easier. □ 



Remark 3.5 Note that it follows from this lemma that (AMC) could also 
have been formulated as follows: every small map / is a covered by a small map 
/' which is the right edge in a collection square in which all maps are small (the 
same is true for display maps, see Lemma 2.11 in [7]). 

Theorem 3.6 The axiom of multiple choice (AMC) is stable under exact com- 
pletion. 
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Proof. Suppose that (AMC) holds in £ and /: B — > A is a small map in £. 
By definition this means that / is a covered by a map of the form yf with /' 
display in £ . Since /' is display in £ and (AMC) holds in £, we may cover /' 
by a map /" in £ which fits in a collection square in which all maps are display. 
That the same holds for / in £ now follows from Lemma l3~3l and Remark [3.5 1 □ 



We will now show that (AMC) is also reflected by exact completions. 

Lemma 3.7 Suppose we are given a cube of the form 

D > B 




in which the right face is a pullback and the faces at the bottom and on the left 
are covering. If the face at the back is a collection square , then so is the face 
at the front. 



Proof. An easy argument using the internal logic. 



□ 



Theorem 3.8 The axiom of multiple choice (AMC) is reflected by exact com- 
pletions. 



Proof. Suppose that (AMC) holds in £ and /: Y —> X is a small map in £ . 
This means that there is a cover q: D — > yX in £ such that q*(yf) fits into the 
right hand side of a collection square in which all maps are small. We construct 
a diagram 

A » B » yY 

yE !— »yF ?*(y/) yf 



i 

C 



D 



yG 



-»yH 



as follows. First we construct the bottom and left faces using Lemma 5.6 in 
[7], so that both are covering and the maps yE —> yG and yG — > yH are both 
small. Then the right face is constructed by pullback and since y preserves pull- 
backs, we may assume that the result is an object of the form yF and the map 
yF — > yH is {qp)*(yf)', in particular, it is small. To hnish the construction of 
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the cube, we have to find a map yE — > yF: but that we obtain from the univer- 
sal property of yF. Note that it follows from Lemma 2.11 in [7J that this map 
is also small. By the previous lemma, we now know that the front face of the 
cube is a collection square in which all maps are small. Since collection squares, 
small maps and pullbacks are reflected by y, we have shown that (AMC) is 
reflected by exact completion. □ 

Note that in [7J we were unable to show that the axioms (IIS) and (WS) 
are stable under exact completion. In the presence of (AMC), however, we 
can. 

Theorem 3.9 In the presence of (AMC), the exponentiation axiom (IIS) is 
stable under exact completion. 

Proof. Relative to (AMC) the exponentiation axiom is equivalent to fullness 
(see pHl Proposition 2.16]), so this follows from the stability of the fullness ax- 
iom under exact completion (Proposition 6.25 in [7J). □ 



Theorem 3.10 In the presence of (AMC), the axiom (WS) is preserved by 
exact completion. If(£,S) is a category with small maps, it will also be reflected. 

Proof. The proof of Theorem 6.18 in [7J implies that the functor y preserves 
W- types. It also preserves smallness and if S is a class of small maps, it will 
reflect smallness as well (see [7J Theorem 5.2]). Hence it follows that exact 
completions of categories with small maps reflect (WS). 

It also follows that W-types for maps of the form yg with g a display map in 
£ are small in £. The proof of the stability of (AMC) under exact completion 
implies that for every small map /: B — > A in £ there is a cover q: A' -» A such 
that q* f fits into a collection square with such a map yg on the left. It is a 
consequence of the proof of Proposition 6.16 in [7J that the W-type associated 
to q* f is small and a consequence of Proposition 4.4 in [13] that the W-type 
associated to / is small. □ 



4 Stability under realizability 

In this section we show that the axiom of multiple choice is stable under re- 
alizability. Recall from [9] that the realizability category over a predicative 
category of small maps £ is constructed as the exact completion of the category 
of assemblies. Within the category of assemblies we identified a class of maps, 
which was not quite a class of small maps. In a predicative setting the correct 
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description of these display maps (as we called them) is a bit involved, but for 
the full subcategory of partitioned assemblies the description is quite simple: a 
map of partitioned assemblies /: (B, j3) — » (A, a) is small, if the underlying map 
/: B — > A in £ is small. Many questions about assemblies can be reduced to 
(simpler) questions about the partitioned assemblies: essentially this is because 
the inclusion of partitioned assemblies in assemblies is full, preserves finite lim- 
its and is covering (i.e., every assembly is covered by a partitioned assembly). 
Moreover, every display map between assemblies is covered by a display map 
between partitioned assemblies. For more details, we refer to [5]. 

Theorem 4.1 The axiom of multiple choice (AMC) is stable under realizabil- 
ity. 

Proof. We show that (AMC) holds in the category of assemblies over a pred- 
icative category of classes £ , provided that it holds in £. The result will then 
follow from Theorem 13.61 above. 

Suppose / is a display map of assemblies. We want to show that / is covered 
by a map which fits into a collection square in which all maps are display. 
Without loss of generality, we may assume that / is a display map of partitioned 
assemblies (B, (3) — > (A, a). For such a map, the underlying map / in £ is small. 
We may therefore use the axiom of multiple choice in £ to obtain a diagram of 
the form 

F — ^— #• D — ^— » B 

f 

E »C » A, 

in which the square on the left is a collection square in which all maps are small 
and the one on the right is a covering square. We obtain a similar diagram in 
the category of (partitioned) assemblies 

S 

( E i e ) — i - * (A 7) — (A a )i 

by defining 7: C — > N by 7(c) = ar(c), and similarly e(e) = arp(c),S(d) = f3s(d) 
and 4>(f) — (3sq(f). It is clear that both squares are covering, so it remains to 
check that the one on the left is a collection square. 

So suppose we have a map t: (X, x) ~* (C, 7) and a cover 

h: (M, fj) (X, x ) x ( C)7 ) (D,5) = (X x c D,n) 
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in the category of assemblies. Without loss of generality, we may assume that 
both (X, x) and (M, /i) are partitioned assemblies and (X Xp D,k) is the par- 
titioned assembly with n{x,d) = (x(x),5(d)). Define 

X' = {(i£l,neN): n realizes the surjectivity of h}, 

M' = {(m G M,n G N) : {irih{m),n) G X' and n ■ K(h(m)) = fj.(m)}, 

and consider the diagram 

M' — X' x c D > D 



X' >C 

t7T 

with h'(m, n) = (irih(m), n, TT2h(m)). By definition of X' , the map /i' is a cover, 
so we may apply the collection square property in £ to obtain a map w: Y — > E 
and a covering square of the form 

w*F M' % X' x c D 

i 

Y >X'. 

V 

Writing u — ttiv.Y — > X and v(y) — (xu(y) 7 TT 2 v(y)), we obtain a similar 
covering diagram 

w*(F, (p) — — > (M, fj) — ^— > (X x c D,k) 
i 

(Y,v)- 

in the category of assemblies 

1. The map u is a cover, essentially because ni:X' — > X is. 

2. The map k = irok' is tracked, because the realizer of an element z in 
w*{F,4>) is the pairing of the realizers of its images (hk)(z) and l(z). 
From the latter, one can compute (by taking the second component) the 
second component n of (vl)(z). One may now compute the realizer of k{z) 
by applying this n to the realizer of (hk)(z) (by definition of M'). 

3. The square is a quasi-pullback, with the surjectivity of the unique map to 
the pullback being realized by the identity. 

This concludes the proof. □ 
Again, we are able to show that (AMC) is also reflected by realizability. 
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Theorem 4.2 The axiom of multiple choice is reflected by realizability. 



Proof. Recall that there are two functors V: £ — > Asm(£) and T: Asm(£) — > £, 
with V sending an object X to the pair (X, IxN) and T sending an object 
(X, x) to X. Both V and T preserve small maps, pullbacks, covers and (hence) 
covering squares. In addition, TV = id, so it suffices to show that T preserves 
collection squares. 



Let 



(D,5) 



(B,(3) 

be a collection square in Asm{£ ) and suppose we are given a map /: X — > A and 
a cover q: E — > X x a B in £. By putting x{ x ) = a (f x ), V'C 1 ) ^) — j(x( x )' 
and e(e) = ip(q(e)) and using the collection square property of the figure above, 
we obtain a diagram in Asm(£) of the following form: 

(Y x c D 7 p) >(E,e) »(Xx A B,^) , 

(D, S) — ! » (S, /?) 

— »(^,X), 

(C, 7) » (A, a) 

where the left face is a pullback and the face at the back is covering. By apply- 
ing F to this diagram we obtain the desired result. □ 



In [9] we were unable to show that the axioms (IIS) and (WS) are stable 
under realizability. This was because we were unable to show that they were 
stable under exact completion. But as that was our only obstacle, we now have: 

Theorem 4.3 In the presence of (AMC), the axioms (IIS) and (WS) are 

stable under realizability. 

Proof. Since both (IIS) and (WS) are inherited by the category of assemblies 
(Propositions 20 and 21 in [9]), this follows from Theorem 13.91 and Theorem 
13.101 respectively. □ 



Theorem 4.4 In the presence of (AMC), the axiom (WS) is reflected by 
realizability. 
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Proof. It follows immediately from the description of W-types in the category 
of assemblies (see [9j Proposition 21]) that V preserves W-types. As V reflects 
smallness, it follows that the axiom (WS) is reflected by rcalizability. □ 



5 Stability under sheaves 

In this section we will show that (AMC) is preserved and reflected by sheaf 
extensions. Theorem 4.21 in [TU] shows that (WS) is preserved by sheaf exten- 
sions in the presence of strong (AMC), but it is not hard to see that the same 
argument shows that (WS) is preserved with our present version of (AMC); 
that it is also reflected will be Theorem 15.51 below. We will use notation and 
terminology from |10j . In particular, (£,S) is a predicative category with small 
maps satisfying the fullness axiom (F) and (C, Cov) is an internal site in £ 
which has a presentation and whose codomain map cod: C\ — > Co is small. We 
will write it*: Pshf(C) —tE/Co for the forgetful functor and m for its left adjoint, 
which sends a pair (X, ax'- X — > Co) to the following sum of representables: 

ir\(X,<T X ) = ^2 y( a x( x ))- 



In other words, 



7ri(X,CT X )(c) = {(i,7):dgCi,i6 X(d),r-C^> d € & }. 

Given two objects (Y,ay) and (X, ax) in £/Cq and a pair of maps k: Y — > X 
and k:Y — > C\ such that 




commutes, we obtain a map of presheaves (k, k)<: ir\Y — > n\X sending a pair 
(y,7) to (k(y), K y "f). In fact, every map ir\Y ir\X is of this form. Finally, 
we will write i* for the sheafmcation functor Pshf:(C) — > Shg(C) and p\:£/Co — > 
Shf(C) for the composition of tt\ and i*. 



Theorem 5.1 The axiom of multiple choice (AMC) is preserved by sheaf ex- 
tensions. 



Note that for strong (AMC) this was proved in Section 10 of |14) . 
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Proof. In this proof we assume that the underlying category C has chosen 
pullbacks, something we may do without loss of generality. Consider a map 

i*(k,K)\: p\Y -> p\X 

of sheaves in which k is small. Since by definition every small map is covered 
by one of this form, it suffices to show that for every such map there is a cover 
such that pulling back the map along that cover gives a map which is the right 
edge in a collection square in which all maps are small. 

Using (AMC) in £ , we know that there is a cover p: I — > X in £ such that p*k 
fits into a collection square in which all maps are small: 




» J — — »• Y 



wX. 



Now we make a host of definitions. Define 07 = crxp, oa = crxpv, cr.j = 
oyq.OB = <7Yqw,pb = Kqwb- Furthermore, we define an object S fibred over 
A: S a consists of pairs (7, v?) with 7 a map in C\ with codomain (74(a) and ip 
a map assigning to every b e B a a sieve S £ BCov(7*ctb(6)), where 7*0-3(6) 
denotes the following pullback in C: 



7*cr B (fe) ► <J B (b) 

Mb 

• ^cr^(a)- 



We also define an object M fibred over 5, with the fibre over (a, 7, ip) consisting 
of pairs b E B a and a e <p(b). We obtain a commuting square as follows: 



M—^B 



S wA, 

9 1 



in which all maps are small and g is a cover. 

We apply (AMC) again, but now to n. Strictly speaking, one would obtain 
a cover r: P — > S such that such that r*n fits into the right-hand side of a 
collection square in which all maps are small. We claim that we may assume, 
without loss of generality, that r = id, so that already n fits into the right-hand 
side of a collection square. Its proof is a bit of a distraction from the main 
thread of the argument, so probably best skipped on a first reading. 
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Proof of the claim. Applying (AMC) to n yields a diagram 



W >Q >M 

n 

v >p »s 

r 



in which the left square is collection and the right one a pullback. By applying 
the collection axiom to the small map vg and the cover r, we obtain a diagram 
of the form 

S" ► 5" ► A' ► /' 



in which I' — > I is a cover, the two rightmost squares are pullbacks and S" — > S' 
is a small cover. The idea is to replace J, A, B, S, M with their pullbacks along 
/' -)■ I. Call these J', A', B', S', M', respectively. Crucially, S' and M 1 are then 
defined in the same way from A' and B' as S and M are defined from A and B. 

We pull back the collection square on P along 5"' — > P and obtain a new 
collection square on S", in which all maps are still small: 



W ■ 



D 



I 

V 



-> T 



P 



C- 



By the universal property of M' we obtain a map T — > M' making the diagram 

Q >M 



D >T- 



I 

P 



S 



C >S" 



commute. Note that this map is small, because all others in the front of the 
cube are. Since the left and right faces of the cube are pullbacks and the back is 
covering, the front of the cube is covering as well. Therefore not only the square 
on S" is a collection square, but also the pasting of that square with the front 
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of the cube. As a result, we have 

D > M' > B' > J' > Y 



C- 



+ X, 



in which the first and third square (from the left) are collection squares in which 
all maps are small. This proves the claim. □ 

So from now on we work under the assumption that r = id and n is the right- 
hand edge of a collection square. The result is a diagram of the following shape: 




where the first and third square (from the left) are collection squares. Note that 
all maps in this diagram except for p and q are small. For convenience, we write 
o = vge, t = whf. 

We wish to construct a diagram of the following shape in presheaves: 



-> TT\J 

-)• ml - 



TT\p 



mY 
^mX. 



Understanding the right square should present no problems: but note that it is 
a pullback with a cover at the bottom. The remainder of the proof explains the 
left square and shows that its sheafification is a collection square in the category 
of sheaves. That would complete the proof. 

Every element c e C determines an element e(c) = (a, 7, <p) E S. We put 
lu c = 7 and trc(c) = dom(7). Note that this turns (o, lo)\ into a cover. Similarly, 
every d G D determines an element f{d) = (b,j,ip,a) £ M. We put ay = a, 
= dom(a), = tti o a and 9d = 7r 2 o a, where 7Ti and 7r 2 are the legs of 
the pullback square 



in, 



-¥ (JA{mb). 



in C. Note that this makes the map from mD to the inscribed pullback of the 
left square locally surjective; hence its sheafification is covering. 
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In order to show that the sheafification of the left square is a collection square, 
suppose that we have a map z: V — > p\I and a cover d: Q — > z* p\J of sheaves. 
Let W be the pullback in presheaves of V along — > p\(I) and cover W 
using the counit ir\ir*W — > W. Writing L = ir*W, this means that we have a 
commuting square of presheaves 



7TI-L ■ 



( r >p)i 



V - 



in which the vertical arrows are locally surjective and the top arrow is of the 
form (r, p)\. Finally, let E: P ->• m(L X/ J) be the pullback of d: Q -> z*ptJ 
along the unique map 7ri(L xj J) — > z*p> J making 



Q 



■Am(Ix ; J). 

/ I 



I 

ir\L ■ 



V 



-> IT, J 



-¥ p\J 



commute. 

Since d is locally surjective, the same applies to E. Reasoning in the internal 
logic, this means that the following statement holds: 

(V/ G L) (Vj G J r{l) ) (3S G BCov(p,Vj(j)) (Va G 5) (3p G P) £7(p) - ((/,j),a). 

Using the collection square property, we find for every I G L an element o G A 
with t>(a) = r(/) together with a function ip G nh e B a BCov(p ; *(crs(6))) such that: 

(V6 G B a ) (Va G p(6)) (3p G P) E(p) = ((I, w(b)),a). 

Again using the collection square property, we find for every I G L an element 
c G C with e(c) = (a, p;, <p) and a function t/j: D c — > P such that 

(VdGD c )f;(V(d)) = ((i.t(d)).a«i)- 

(Remember t = whf.) Therefore we obtain a diagram of the following shape in 
£: 



Ux c D 



¥ L Xi J 




20 



with 



U = {(I £ L,c £ C,ip:D c -> P) : o(c) = r(l),u> c = p x and 

(Vde AO£(W) = ((M(d)W}, 

77, e the obvious projections and 6(Z, d, = (/, We now obtain a diagram 

of presheaves of the shape 



7T.([/ X C D) - 



(b,0h 



■TT\(L X/ J) 




with au(c,l,il>) = dom(o; c ) = uc(c) = dom(p;) = <7l(1). In this diagram, the 
square on the left is a pullback square computed in the customary manner with 
&Ux c d(1, d, VO = <JD(d), and the unique map (b, (3)\ filling the diagram is given 

by P(i,d,i>) = ad- 

We now show that the sheafification of the square at the back is covering. First 
observe that 7n?7 is a cover, since r\ is. Therefore we only need to show that the 
square at the back is "locally" a quasi-pullback. To that end, suppose we have 
an element ((I, c, ip), 7Ti) in U and element ((l,j),\d) £ m{L X/ J), where m is 
the projection obtained as in 



-W(p**)(j))- 



If e(c) = (a,w c ,<p), then we find a, b E B a with w(6) = j. Writing T = 
ip{b) £ BCov(crz,x 7 j)), we find for every a £ T an element d £ D c with 
/(d) = (6, cj c , <£, a). Projecting ((/, d, -0), id) £ n\(U Xc D) to 7ri(L X/ J) yields 
((Z,t(<i)),ad) = id) • a and projecting ((l,d,ip), id) G 7n(f7 Xp -D) to mC/ 

yields ((I, c, ip), m o ay) = ((Z, c, -0), 7Ti) • a. This shows that the square at the 
back is "locally" covering. (We have used here that every element in an object 
of the form ir\Z is a restriction of one of the form (z, id) and that it therefore 
suffices for proving that a map Q: R — > tt\Z is locally surjective to show that 
every element of the form (z, id) is "locally hit" by Q.) 

To complete the proof we need to show that (b, f3)\ factors through E:P^> 
7T)(L x j J). But to define a map G: m (U x c D) — > P is, by the adjunction, the 
same thing as to give a map U XcD->P, which we can do by sending (I, d, ip) 
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to ip(d). To show that (b, (3)\ = E o G, it suffices to calculate: 



(EoG)((l,d,i>)>\d) 



m(d)) 

((l,t(d)),a d ) 
(6,/3),((Z,d,V),id). 



This completes the proof. 



□ 



We will finish this section by showing that (AMC) and (WS) are reflected 
by taking sheaves over an internal Grothendieck site (C,Cov), provided every 
covering sieve is inhabited. Our argument relies on Proposition l5.4l that in turn 
relies on two lemmas. 

Lemma 5.2 Suppose X is a presheaf and (S,x) and (T,y) are two compatible 
families on c G Cq. Then they agree on a common refinement iff for every 
(7: d — i- c) G S PiT there is a sieve R covering d such that for every S S R we 
have x 1 s = y-yd- 

Proof. =$■: Suppose (S, x) and (T, y) agree on a common refinement and 7: d — > 
c belongs both to S and T. We know that there is a sieve U covering c which 
refines S and T and on which x and y agree. Pulling back this sieve along 7 we 
find a sieve R covering d. Then x and y agree on all elements of the from 7^ 
with S G R. 



We need to show that U is covering. For this purpose, pick 70 : c ->c£ S and 
7x: d — y Co G JqT. Then 7 = 7071 G Sf]T and therefore there is a covering sieve 
R on d such that for every 5 G R we have x^s = y-ys- In particular, j*U cov- 
ers d. But then JqU covers Cq and U covers c, both times by local character. □ 



Lemma 5.3 Suppose (C, Cov) is an internal Grothendieck site in £ in which 
both Cq and every covering sieve are inhabited. Let X be an object in £ and 



be the constant presheaf over X . Then equivalence classes of compatible families 
over this constant presheaf which agree on a common refinement are small. 

Proof. Note that if (S, x) is one compatible family from tt\(X x Co, ^2) over 
c and (T, y) is another, then they agree on a common refinement iff we have 
%a — Va for every a G S H T. This is an immediate consequence of the previous 
proposition and the fact that every cover is inhabited. 



Put 



U = {a G S n T : x, 



Va}- 



7ri(X x C ,7r 2 ) 
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If (S, x) is a compatible family on c £ Co, then the collection of compatible fam- 
ilies which agree with it on a common refinement is in bijective correspondence 
with the set 

{TgBCov(c) : (V T -d^>- c£T)(V8:e^>- d,8':e' ^ d) 
( jS e S A 7<S' G S -> x 7 s = x~<6> ) }■ 

For if T belongs to a compatible family (T, y) which agrees with (S, x) on a 
common refinement, and we have maps 7, 5, 5' in C with 7 G T, 7<5 G 5 and 
7*' e S", then 

by the the remark we made at the end of the previous paragraph. 

Conversely, if T is a basic covering sieve with this property and 7 G T, then we 
can pull back S along 7; this yields a covering sieve and since covering sieves 
are inhabited, this means there is a 5 such that *y6 G T. So we may put 

2/7 • ^7<5 , 

which does not depend on the choice of 6 by the assumption on T. This yields a 
compatible family (T,y) which is equivalent to (S,x). Moreover, this construc- 
tion is clearly inverse to the operation of dropping the y from the (T, y). So we 
conclude that equivalence classes of compatible families are small, because they 
are in bijective correspondence with the set above. □ 



Proposition 5.4 Suppose (C, Cov) is an internal Grothendieck site in £ in 
which both Cq and every covering sieve are inhabited. Then the functor A which 
sends every object X to the sheafification of the constant presheaf over X reflects 
smallness. 

Proof. Assume (C, Cov) is an internal Grothendieck site in £ in which both Co 
and every covering sieve are inhabited. From the latter assumption it follows 
that every constant presheaf is separated, so A(X) is obtained by quotienting 
the compatible families over the constant presheaf over X; since the equivalence 
classes are small by the previous lemma, this implies that the object of compat- 
ible families over the constant presheaf on X is small whenever A(X) is. Since 
the constant families on some object c G Co (i.e., those (S, x) for which S is the 
maximal sieve on c) can be identified by a bounded formula, X will then be 
small as well. □ 



Theorem 5.5 Suppose (C, Cov) is an internal Grothendieck site in £ in which 
both Co and every covering sieve are inhabited. If (WS) holds in sheaves over 
(C,Cov), then it also holds in £. 
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Proof. It is not hard to see that A preserves W-types in the sense that 

W(A(f)) = A(W(f)). 
Therefore the statement follows from Proposition [531 



□ 



Theorem 5.6 Suppose (C, Cov) is an internal Grothendieck site in £ in which 
both Co and every covering sieve are inhabited. If (AMC) holds in sheaves over 
(C,Cov), then it also holds in £. 

Proof. For once we reason internally. Assume (C, Cov) is a small site in which 
both Co and every covering sieve are inhabited. Let X be a small object in £. 
Consider m (X xCo, 7r 2 ), the constant presheaf over X. This presheaf is separated 
and hence a dense subobject of its sheafification AX: = p\(X x Co, 7^). For an 
element t g AX(c), we will write t £ X if it belongs to this subobject. 

We first apply (AMC) in the category of sheaves to AX; concretely this means 
that there is diagram 

Y ► U x AX > AX 

I wU »1 

in the category of sheaves in which the square on the left is a collection square. 
By replacing, if necessary, the category of sheaves over (C, Cov) by its slice over 
U (which is also a category of sheaves), we may assume that U = 1. Therefore 
the diagram above reduces to 

Y—^AX 

G 

I » 1. 

For the moment, fix a pair c £ Co and i S 1(c). Write 

Yd ={(a:d^c,yeY i (d)): G d (y) = % ■ a, F d (y) e X} 

and let F ci :Y ci ~ > X be the obvious projection. Since the square above is 
covering and every covering sieve is inhabited, this map is surjective. 

We now use fullness in £ to find a small collection A c ,i Q Pow(Y Cj i) such that: 

1. For every element A G A c ,i the map F c ^ \ A: A — > X is still surjective. 

2. For every small B C Y c> i, if F c ^ \ B: B — >■ X is surjective, then there is an 
element A g A c ,i such that A C B. 
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(Strictly speaking we also need to use the collection axiom to justify writing 
these small collections A c ,i as a function of (c, i): see Lemma [6.41 below.) We 
claim that 

{F c<i \ A: A -> X : c G C , i G 1(c), A G A c<i ) 

is a set of surjections onto X as in the statement of (AMC). 

To see this, let P — > X be an arbitrary surjection. The map AP — > AX is 
still a surjection, but then in the category of sheaves. Therefore in the category 
of sheaves there exists a surjection V — > 1 and a map £: V — >• / fitting into a 
covering square 

Fx,y — AP » AX 

V »1. 

Pick c € Co such that V(c) is inhabited, say v € V(c), put i — £(v) G 1(c) and 

B = { (a: d c, y) £ F C! , : iJ d (« • a, y) G P }. 

The proof will be finished once we show that F c .i \ B: B — >• X is surjective. 

So let x G X. Since F c ,i is surjective and every cover is inhabited, this means 
that there is a pair (a: d —± c,y) £ Y c j such that Fd(y) = x. Since Hd(i ■ a, y) G 
7*(P)(d) and 7n(P x Co, 7^) lies dense in 7*P, we find /?: e — )• c? with 

H e (i-aj3,v0)eP. 

Therefore (af3, y ■ (3) £ B and F c ^(af3, y ■ (3) = F e (y ■ f3) = x. □ 



6 Relation of AMC to other axioms 

It will be the aim of this section to compare our version of (AMC) to other 
axioms which have appeared in the literature, including the principle called the 
axiom of multiple choice in [14j and its reformulation in |15j . Throughout this 
section, our metatheory will be CZF. 

Before we compare our axiom to the principles in [14] and [15] , we first need 
to make a definition. 

Definition 6.1 We will say a surjection p: Y — >• X refines another surjection 
q: Z — >• X if there is a map f:Y^>-Z such that qf = p. An indexed family 
(Yi)i£i will be called a collection family if each surjection p: E —¥ Y% is refined 
by one of the form q: Yi> — > Yi. 

Consider: 
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1. The axiom of multiple choice according to [14] : for every set X there is an 
inhabited collection family (Yl)i^i together with surjections qcYi — > X. 

2. A strengthened version of the above: for every set X there exist an inhab- 
ited collection family (Yi) i£ j and surjections qfY^ —> X such that each 
surjection p: E — > 1^ is refined by a map q: Yy — > Y t over X. 

3. The axiom of multiple choice as reformulated in |15j): every set X is a 
member of a collection family. 

Proposition 6.2 These principles are all equivalent in CZF. 

Proof. (1) => (3): simply add the set X to the collection family. 

(3) =>■ (2): if (Zk)keK is a collection family containing X, then let / be the 
collection of all surjections Zk — > X. 

(2) (1) is obvious. □ 

We will call any of these equivalent principles strong (AMC). As the name 
suggests, it implies our present version of (AMC). 

Proposition 6.3 Strong (AMC) implies (AMC). 

Proof. Suppose X is a set and {pi'.Yi -» X : i € /} is an inhabited set of 
surjections as in version 2 of strong (AMC). We claim that {pi : i G /} is also 
a set of surjections witnessing (AMC) in the sense of this paper. To show this, 
let /: Z -» X be any surjection. Since / is inhabited, we can pick an element 
i e / and construct the pullback: 

T^^Y Z 

Pi 

Z »X. 

f 

Using the property of {pi : i € /}, we find a j € J and a surjection h: Yj -» Y, L 
factoring through g. Therefore pj = pi o h factors through /. □ 

We expect the converse to be unprovable in CZF. However, there is an axiom 
scheme suggested by Peter Aczel in [5] which implies that our present version 
of (AMC) and strong (AMC) are equivalent. This axiom scheme is: 

The Relation Reflection Scheme (RRS): Suppose R, X are classes and R C 
X x X is a total relation. Then there is for every subset x C X a subset 
y C X with iCj such that (Vo € y) (36 £ y) (a, b) e R. 
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Our proof of this fact relies on the following lemma: 

Lemma 6.4 Suppose tp(x,y) is a predicate such that 

<p{x,y) AyCt/'^ <p(x,y'). 

Then, if 

(Vas G a) (3y)(p(x,y), 
there is a function f:a~^V such that tp(x, f(x)) for all x G a. 

Proof. First use collection to find a set b such that 

(Vx G a) (3z G b) ( z = (zq, z\) A z a = x A (fi(z , Zi)j. 

Then put f(x) = \J{zi : (x, Zi) G b}, which is a set by the union and replace- 
ment axioms. □ 



Proposition 6.5 Strong (AMC) follows from (AMC) and (RRS). 

Proof. Fix a set X. We define a relation R C Pow(Surj(X)) x Pow(Surj(X)) 
by putting 

(a, /3) G R iff for every /:F^l£a and every surjection g: Z — > y 
there are h:T X G f3, p:T ^» Y and k:T ^ Z fitting into a 
commutative diagram as follows: 



T— 




z >y. 
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It follows from (AMC) that R is total: for if a is any set of surjections onto X, 
then (AMC) implies that for every /: Y — > X G a there is a set of surjections 
onto Y such that any such is refined by one in this set. By applying the previous 
lemma to this statement, we find for every / G a a set Af of surjections with 
this property. Wc find our desired (3 as /3 = {/ o g ; j 6 Aj}. 

By applying (RRS) to R, we obtain a set M C Pow(Surj(X)) such that 
{\d x :X — > X} G M and (Va G M) (30 G M) (a, (3) G R. Put = (J A/. 
It is straightforward to check that N is a set of surjections witnessing strong 
(AMC). □ 



Note that the following was shown in [T4] : 
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Theorem 6.6 [14, Theorem 7.1(h)] The regular extension axiom (REA) fol- 
lows from the combination of strong (AMC) and (WS). 

We expect this theorem to fail if one replaces strong (AMC) with our present 
version of (AMC). (In fact, this is the only application of strong (AMC) we 
are aware of that probably cannot be proved using our weaker version.) We do 
not consider this a serious drawback of our present version of (AMC) or our 
proposal to extend CZF with (WS) and this axiom, because the main (and, 
so far, only) application of (REA) is the Set Compactness Theorem, which, 
as we showed in Section 2, is provable using (WS) and the present version of 
(AMC). 

7 Conclusion 

We have shown that CZF + (WS) + (AMC) is system which is accept- 
able from a constructive and generalised-predicative standpoint, which is strong 
enough to prove the Set Compactness Theorem and which is stable under the 
standard constructions from algebraic set theory of exact completion, realiz- 
ability and sheaves. Moreover, this extension is robust in the sense that it is 
also reflected by these constructions. As a consequence of stability, the methods 
from [TT] are applicable to it and show that the system satisfies various derived 
rules, such as the derived Fan Rule and the derived Bar Induction Rule. 
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